same password for all users

Sam,

Unless you can convince them that using common passwords is like everybody having the same bank account number, now is a good time to update your resume. When money disappears or confidential information gets inproperly disclosed, it will be ugly.

Good luck.

Craig Herberg

You company looking to do a header or face some lawsuits? Perhas they are looking to fire EVERYONE when the system is jeopardized or misused?

I know you aren't for this either but I have to laugh, sorry.

Try this one out:

As the management at this company has decided not to care about what people do with their computers any longer, I am hereby relieved of ANY repercussions brought on the company by misuse of computers for:
-Identity theft
-Customer losses
-Child pornigraphy sent through or downloaded to the company server
-ALL file sharing and software copyright infringement
-Installation of malicious code
-Sending private company data to other companies
-Hacking the company's banking information
-Public sharing of client data
-Physical damage to the company's hardware investment
-Email abuse or Spam that has the company's domain name and internet access revoked
-anything else possibly related in anyway to client use or abuse of company systems including; ALL staff members, Janitors, thieves & management (same thing), passers by who want access to company information and ANY outside hacks or breaches of the company network and customer information.

I further request that ALL of our company's clients are informed that their personal and credit data is NOT secured and is available to all staff within the organization, or anyone else for that matter. However our competitors are still prepared to secure their personal/company data for them.

Signed:

_______________________
Dumbass Manager

While I'm sure that all these "ha ha only serious" replies you're getting are amusing (I had a good laugh over the bit about severance pay), this unfortunately doesn't solve your problem. Then again, I'm not sure your problem has a solution.

I absolutely agree that it's time to update your resume. You might think about checking "no" in the "May we contact your employer?" box when applying at a new company in this case. In fact, you should start [b]aggressively[/b] seeking new employment opportunities at this time. You're moving into a no-win situation with this employer.

The reason you probably won't get any liability release forms for something like this is that nobody that knows anything useful about system security ever has the problem of needing such a liability release form. Such people have a tendency to just walk away from a job like that. Furthermore, I'm not sure that a liability release like the one for which you're asking would stand up in court under most circumstances. The only thing it's likely to do for you, in practical terms, is piss off your employer. What it's likely to do [b]to[/b] you, on the other hand, is provide proof positive in court that both you and your employer knew that what you were doing might lead to actionable problems, thus actually doing the opposite of what you'd like to happen with a liability release.

Get out. Get out now. Run, don't walk, to a new employer. You have my sympathies.

To demonstrate the benefits of outsourcing parts of IT to multiple companies, look at this. At my previous employer, it took 3 different companies to get your password reset.

The user at Co A called the Help Desk at Co. B, who called application support at Co A,
who reported to IT Security at Co. C,
who reported it to IT security to Co B,
who called the sysadmin at Co. B,
who reset the password.

It had to be done this way because each company was trying to follow 'Best Practices' and was inflexible about procedures. We in Co. A had no ability to bypass the procedures, and the powers that be in Co's B and C would not change their procedures.

The business had the password the same for all users because they couldn't deal with the lost productivity in waiting for passwords to be reset.

I want to thank you all for 1) confirming my thoughts and fears and 2)the attempts at comical releaf even though we all know this is not something to be taken lightly.

I have resolved to try and put inplace a strick password policy and computer use policy. It is my hope that the principals take into account the advice of you and many others like you.

Thanks again.

Sam

Frequently the problem is not knowing someone left, especially in large organizations. I have long advocated using login scripts that query Human Resources for active employee assignments -- no active job assignment, no login. Of course, this only make sense for fairly large organizations.

Craig Herberg